The 5-document contract stack for vendor onboarding

Why one document isn't enough

When you sign your first vendor at a Seed-stage startup, the deal often sits in a single 6-page contract. By Series A, the same relationship needs five documents. That's not bureaucracy — it's the consequence of separating concerns. Each document does one job; together they let you change one piece without renegotiating the others.

Document 1 — Mutual NDA (MNDA)

Signed first, often before any commercial discussion. Covers what each side can do with the information shared during evaluation. Should be standalone and survive even if no deal is signed. Term: typically 3–5 years for confidentiality, indefinite for trade secrets.

Document 2 — Master Services Agreement (MSA) or Master Subscription Agreement

The terms-and-conditions umbrella. Covers IP, liability, indemnification, warranties, term and termination, governing law — everything that's stable across multiple engagements. Signed once, used for years. Should not contain any commercial terms (price, quantity, term) — those go in the Order Form or SOW.

Document 3 — Order Form / Subscription Order

The commercial layer. Specifies what's being bought, how much, for how long, at what price. Typically 1–2 pages. Has a precedence clause that lets it modify the MSA where they conflict — which is how you negotiate exceptions without rewriting the MSA.

Document 4 — Statement of Work (SOW)

For services engagements only. Specifies scope, deliverables, milestones, acceptance criteria, and timeline. Treats the MSA as background and itself as the foreground. A good SOW is detailed enough that a third party could pick up the project mid-stream and finish it.

Document 5 — Data Processing Agreement (DPA)

Mandatory under GDPR Article 28 if the vendor processes personal data on your behalf. Many vendors publish a standard DPA that you can either accept or red-line. The DPA references the MSA and adds the Article 28 obligations. See our DPA explained post for the eight required clauses.

How they fit together

Read in order of precedence (highest first): Order Form / SOW → MSA → DPA. The Order Form modifies the MSA for that specific engagement. The DPA adds privacy-specific terms. If your contract stack doesn't have an explicit precedence clause, conflicts get resolved by a court — slow, expensive, and rarely in your favour.

Versioning and renewals

When the vendor updates the MSA, you don't need to re-sign existing Order Forms (they reference the version of the MSA in effect at signing). Build a register that records: MSA version per vendor, all active Order Forms, all active SOWs, and the renewal date for each. This is exactly what a CLM is for.

AI as the stitching layer

Maintaining five documents per vendor across hundreds of vendors is operationally hard. ContractScan AI cross-references each contract against the others, flags precedence conflicts, tracks which vendor's MSA you've signed which version of, and surfaces missing DPAs. That cross-document view is something no human in-house team can maintain by hand at scale.